TOWARD OPERATIONALLY RELIABLE IOT NETWORK INTRUSION DETECTION: EXPLAINABLE BOOSTING WITH DIAGNOSTIC ERROR ANALYSIS

Abstract

The accelerated growth of Internet of Things (IoT) networks has substantially increased their vulnerability to sophisticated cyber threats, necessitating reliable and transparent intrusion detection systems (IDS). While boosting-based machine learning algorithms demonstrate strong predictive performance, many studies prioritize accuracy alone without adequately examining operational reliability or model interpretability. This study presents a structured evaluation of boosting-based intrusion detection using the TON_IoT network telemetry dataset, comparing a Decision Tree baseline against three state-of-the-art boosting algorithms:XGBoost, LightGBM, and CatBoost. Models are assessed using accuracy, ROC-AUC, and operational error metrics, with particular emphasis on false negatives due to their critical security implications.Experimental results demonstrate that LightGBM achieved the best overall performance, with 99.89% accuracy, the lowest false positive count (28), and the lowest false negative count (13), representinga 61.8% reduction in missed attacks compared with the baseline. A 5-fold cross-validation analysis confirms model stability. To enhance transparency, SHapley Additive exPlanations (SHAP) are applied for both global and local interpretability.Global analysis revealed protocol-level dominance, with TCP-based traffic emerging as the primary driver of malicious classification, while local explanations identified protocol-dependent bias contributing to rare false negatives. These findings demonstrate that integrating explainable AI with boosting algorithms achieves near-optimal detection performance while revealing structural dataset biases and operational blind spots. The proposed framework supports the development of interpretable, high-performance IoT intrusion detection systems.